The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party community packages through official package managers.
Evidence: Instructions include meteor add for Atmosphere packages (e.g., jam:archive, wreiske:meteor-wormhole) and meteor npm install for npm packages (e.g., meteor-rpc, zod).
Source Verification: The skill explicitly instructs the agent to check ownership, release history, and maintenance signals (via Packosphere) before adoption.
[COMMAND_EXECUTION]: The skill uses standard environment inspection commands for package triage.
Evidence: Provides bash snippets for meteor show, meteor list, and meteor npm view to verify versions and package metadata.
[INDIRECT_PROMPT_INJECTION]: The skill identifies and mitigates risks associated with packages that ingest external data or expose internal logic.
Exposure surface: wreiske:meteor-wormhole allows exposing Meteor methods to AI agents (MCP) and REST endpoints.
Mitigation: The skill mandates a "Required checks" protocol that includes refusing unauthenticated "all-in" exposures, performing an inventory of authorization controls, and requiring explicit opt-in for exposed methods.
[DATA_EXPOSURE]: The skill provides guidance on managing data boundaries when using local storage or archival packages.
Evidence: For jam:offline, it warns that IndexedDB is user-readable storage and requires clearing account-specific data on logout. For jam:soft-delete, it requires auditing raw Mongo access and publications where automatic filtering might be bypassed.

meteor-community-packages